spring-projects / spring-projects/spring-security

CSRF token request is same or different for every requests

Open
#19,458 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

status: waiting-for-triage type: bug
Dominant language
Java
Stars
9.6k
Forks
6.3k
Avg merge
2d 11h
Merged PRs (30d)
52

Description

hi all,
I recall last time, when i use spring security, after login successfully, for each request sent to server, the latter will response with a webpage embedded with the same csrf token. This is understandable, since OWSAP did mention that the csrf token values NO NEED change for every request, unless of course after we logout and relogin again, the CSRF token should change to a different one.

but today using spring security v7 and spring boot 4.1, i notice now every requests returns different csrf tokens.

I have no issue with the change, but just want to get a confirmed my observation is correct

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

The report concerns CSRF token behavior in Spring Security v7 with Spring Boot 4.1; start by reproducing requests after login and comparing token values across responses. Check the Spring Security CSRF documentation and relevant tests for the expected token lifecycle. Done means confirming whether per-request rotation is intended and documenting the result.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, spring-boot
Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.